@canonmsg/codex-plugin 0.25.1 → 0.26.2

package/README.md

@@ -60,6 +60,37 @@ You do not need a git repo for host mode. Any readable working directory is vali
 - Quiet group turns: in groups the host shows the thinking indicator and the
   answer only; direct chats keep the live preview and margin activity
 
+### Service-agent mode
+
+Long-running customer agents can use the same Canon host without exposing its
+coding controls:
+
+```bash
+canon-codex \
+  --cwd /srv/agent-workspace \
+  --service-agent \
+  --no-native-vision
+```
+
+`--service-agent` removes the coding-oriented dynamic tools and exposes only
+`codex_app.canon_runtime_control` plus `codex_app.no_reply`. Runtime control is
+bound by the host to the active Canon conversation and authenticated human; the
+model cannot select another user, conversation, or responder. It can display a
+card with `send_card`, wait for an action card with `request_card`, or ask one
+standalone question with `request_input`.
+
+Service-agent sessions use the configured shared workspace and read-only local
+filesystem automatically. They do not ask conversation members to choose a
+coding workspace, execution mode, model, reasoning level, or permission mode.
+
+Authorized conversation members may use a service agent even when they do not
+own its Canon identity. Normal coding-host sessions keep their existing
+owner-only execution boundary.
+
+`--no-native-vision` keeps inbound attachment paths in the prompt while
+suppressing Codex's native image input. This lets a service agent use its
+purpose-built OCR tool as the only image-recognition path.
+
 ## Transports
 
 The host picks a transport at startup and logs the choice as

package/dist/app-server-adapter.js

@@ -382,11 +382,26 @@ export class CodexAppServerAdapter {
     }
     async handleServerRequest(request) {
         try {
+            const params = isRecord(request.params) ? request.params : {};
+            // Detached child threads may use the ordinary coding-thread bridge, but
+            // Canon conversation controls belong only to the foreground human turn.
+            // A fork can inherit dynamic-tool declarations, so enforce this again at
+            // dispatch instead of relying only on the child thread's advertised list.
+            if (isForegroundCanonToolCall(params) && !this.isCurrentThreadNotification(params)) {
+                this.write({
+                    id: request.id,
+                    error: {
+                        code: -32001,
+                        message: 'Server request does not belong to the active Canon turn',
+                    },
+                });
+                return;
+            }
             const result = this.currentRequestHandler
                 ? await this.currentRequestHandler({
                     id: request.id,
                     method: request.method,
-                    params: isRecord(request.params) ? request.params : {},
+                    params,
                 })
                 : defaultServerRequestResult(request.method);
             this.write({ id: request.id, result });
@@ -616,6 +631,15 @@ export class CodexAppServerAdapter {
         this.child.stdin.write(`${JSON.stringify(message)}\n`);
     }
 }
+function isForegroundCanonToolCall(params) {
+    const rawTool = readString(params, 'tool');
+    if (!rawTool)
+        return false;
+    const tool = rawTool.startsWith('codex_app.')
+        ? rawTool.slice('codex_app.'.length)
+        : rawTool;
+    return tool === 'canon_runtime_control' || tool === 'no_reply';
+}
 function parseJson(line) {
     try {
         const parsed = JSON.parse(line);

package/dist/codex-app-tools.d.ts

@@ -43,6 +43,7 @@ type DynamicToolCallResponse = {
  * the host's turn, not to the app-server bridge.
  */
 export declare const CODEX_NO_REPLY_TOOL_NAME = "no_reply";
+export declare const CANON_RUNTIME_CONTROL_TOOL_NAME = "canon_runtime_control";
 /**
  * What the model actually sees for the tool above, for prompt text that names
  * it (the group posture cue). Only meaningful on the app-server transport —
@@ -50,10 +51,28 @@ export declare const CODEX_NO_REPLY_TOOL_NAME = "no_reply";
  */
 export declare const CODEX_NO_REPLY_MODEL_TOOL_NAME = "codex_app.no_reply";
 export declare const CODEX_APP_DYNAMIC_TOOLS: ReadonlyArray<DynamicToolSpec>;
+/** The complete model-visible surface for non-coding service agents. */
+export declare const CODEX_SERVICE_AGENT_DYNAMIC_TOOLS: ReadonlyArray<DynamicToolSpec>;
+/**
+ * Tools exposed to detached Codex threads created through the bridge. Canon
+ * conversation controls belong only to the foreground turn that received the
+ * human message; a child thread has neither that turn nor its responder.
+ */
+export declare const CODEX_DETACHED_THREAD_DYNAMIC_TOOLS: ReadonlyArray<DynamicToolSpec>;
 export declare function isCodexAppToolCall(params: Record<string, unknown>): boolean;
 export declare function deniedCodexAppToolResult(reason: string): DynamicToolCallResponse;
+export declare function successfulCodexAppToolResult(payload: unknown): DynamicToolCallResponse;
 /** True when this dynamic-tool call is the deliberate-silence verb. */
 export declare function isCodexNoReplyToolCall(params: CodexAppToolCallParams): boolean;
+export declare function isCanonRuntimeControlToolCall(params: CodexAppToolCallParams): boolean;
+export declare function isCodexServiceAgentToolCall(params: CodexAppToolCallParams): boolean;
+export interface CanonRuntimeControlRequest {
+    action: 'send_card' | 'request_card' | 'request_input';
+    card?: unknown;
+    prompt?: string;
+    placeholder?: string;
+}
+export declare function parseCanonRuntimeControlRequest(params: CodexAppToolCallParams): CanonRuntimeControlRequest | null;
 /** Private rationale, when the model supplied one. Logged, never rendered. */
 export declare function readCodexNoReplyReason(params: CodexAppToolCallParams): string | undefined;
 /**

package/dist/codex-app-tools.js

@@ -89,12 +89,51 @@ function tool(name, description, inputSchema, deferLoading = true) {
  * the host's turn, not to the app-server bridge.
  */
 export const CODEX_NO_REPLY_TOOL_NAME = 'no_reply';
+export const CANON_RUNTIME_CONTROL_TOOL_NAME = 'canon_runtime_control';
 /**
  * What the model actually sees for the tool above, for prompt text that names
  * it (the group posture cue). Only meaningful on the app-server transport —
  * the `exec --json` transport registers no dynamic tools.
  */
 export const CODEX_NO_REPLY_MODEL_TOOL_NAME = `codex_app.${CODEX_NO_REPLY_TOOL_NAME}`;
+const CANON_RUNTIME_CONTROL_TOOL = tool(CANON_RUNTIME_CONTROL_TOOL_NAME, 'Interact with the current Canon conversation. Send a display card, request one card response, '
+    + 'or ask one short question. Canon binds the current conversation and authenticated responder; '
+    + 'never ask for or invent routing ids.', {
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+        action: {
+            type: 'string',
+            enum: ['send_card', 'request_card', 'request_input'],
+        },
+        card: {
+            type: 'object',
+            description: 'A canon.card.v1 document. Use request_card when it contains actions.',
+        },
+        prompt: {
+            type: 'string',
+            description: 'A short question for request_input.',
+        },
+        placeholder: {
+            type: 'string',
+            description: 'Optional example or formatting hint for request_input.',
+        },
+    },
+    required: ['action'],
+}, false);
+const CODEX_NO_REPLY_TOOL = tool(CODEX_NO_REPLY_TOOL_NAME, 'End your turn without posting anything to the conversation. Use it in group '
+    + 'chats when you have nothing to add — no message is created, so no other '
+    + 'member or agent is triggered. Optional private reason (logged, never '
+    + 'shown). After calling this, produce no further text.', {
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+        reason: {
+            type: 'string',
+            description: 'Never rendered; logged only.',
+        },
+    },
+}, false);
 export const CODEX_APP_DYNAMIC_TOOLS = [
     tool('automation_update', 'Create, update, view, or delete Codex app automations. Canon exposes the name for compatibility, but does not manage Desktop automations.', {
         type: 'object',
@@ -205,24 +244,23 @@ export const CODEX_APP_DYNAMIC_TOOLS = [
         },
         required: ['threadId', 'title'],
     }),
+    CANON_RUNTIME_CONTROL_TOOL,
     // Canon's `no_reply` verb, projected into the only model-visible tool surface
-    // the Codex transport gives us. It is answered by the Canon host itself (see
-    // `handleCodexServerRequest`), never by `handleCodexAppToolCall` — the host
-    // owns the turn this call is about.
-    tool(CODEX_NO_REPLY_TOOL_NAME, 'End your turn without posting anything to the conversation. Use it in group '
-        + 'chats when you have nothing to add — no message is created, so no other '
-        + 'member or agent is triggered. Optional private reason (logged, never '
-        + 'shown). After calling this, produce no further text.', {
-        type: 'object',
-        additionalProperties: false,
-        properties: {
-            reason: {
-                type: 'string',
-                description: 'Never rendered; logged only.',
-            },
-        },
-    }, false),
+    // the Codex transport gives us. It is answered by the Canon host itself.
+    CODEX_NO_REPLY_TOOL,
+];
+/** The complete model-visible surface for non-coding service agents. */
+export const CODEX_SERVICE_AGENT_DYNAMIC_TOOLS = [
+    CANON_RUNTIME_CONTROL_TOOL,
+    CODEX_NO_REPLY_TOOL,
 ];
+/**
+ * Tools exposed to detached Codex threads created through the bridge. Canon
+ * conversation controls belong only to the foreground turn that received the
+ * human message; a child thread has neither that turn nor its responder.
+ */
+export const CODEX_DETACHED_THREAD_DYNAMIC_TOOLS = CODEX_APP_DYNAMIC_TOOLS.filter((entry) => (entry.name !== CANON_RUNTIME_CONTROL_TOOL_NAME
+    && entry.name !== CODEX_NO_REPLY_TOOL_NAME));
 const CODEX_APP_TOOL_NAMES = new Set(CODEX_APP_DYNAMIC_TOOLS.map((entry) => String(entry.name)));
 const UNSUPPORTED_TOOLS = new Map([
     ['automation_update', 'Canon does not manage Codex Desktop automations.'],
@@ -246,10 +284,38 @@ export function isCodexAppToolCall(params) {
 export function deniedCodexAppToolResult(reason) {
     return toolResult(false, { error: reason });
 }
+export function successfulCodexAppToolResult(payload) {
+    return toolResult(true, payload);
+}
 /** True when this dynamic-tool call is the deliberate-silence verb. */
 export function isCodexNoReplyToolCall(params) {
     return normalizeToolName(params.tool) === CODEX_NO_REPLY_TOOL_NAME;
 }
+export function isCanonRuntimeControlToolCall(params) {
+    return normalizeToolName(params.tool) === CANON_RUNTIME_CONTROL_TOOL_NAME;
+}
+export function isCodexServiceAgentToolCall(params) {
+    const toolName = normalizeToolName(params.tool);
+    return toolName === CANON_RUNTIME_CONTROL_TOOL_NAME || toolName === CODEX_NO_REPLY_TOOL_NAME;
+}
+export function parseCanonRuntimeControlRequest(params) {
+    if (!isCanonRuntimeControlToolCall(params))
+        return null;
+    const args = parseToolArguments(params.arguments);
+    const allowedKeys = new Set(['action', 'card', 'prompt', 'placeholder']);
+    if (Object.keys(args).some((key) => !allowedKeys.has(key)))
+        return null;
+    const action = readString(args, 'action');
+    if (action !== 'send_card' && action !== 'request_card' && action !== 'request_input') {
+        return null;
+    }
+    return {
+        action,
+        ...(args.card !== undefined ? { card: args.card } : {}),
+        ...(readString(args, 'prompt') ? { prompt: readString(args, 'prompt') } : {}),
+        ...(readString(args, 'placeholder') ? { placeholder: readString(args, 'placeholder') } : {}),
+    };
+}
 /** Private rationale, when the model supplied one. Logged, never rendered. */
 export function readCodexNoReplyReason(params) {
     const args = parseToolArguments(params.arguments);
@@ -314,6 +380,12 @@ export async function handleCodexAppToolCall(runtime, params) {
             error: 'no_reply is answered by the Canon host, not the app-tool bridge.',
         });
     }
+    if (toolName === CANON_RUNTIME_CONTROL_TOOL_NAME) {
+        return toolResult(false, {
+            tool: toolName,
+            error: 'canon_runtime_control is answered by the Canon host, not the app-tool bridge.',
+        });
+    }
     const unsupportedReason = UNSUPPORTED_TOOLS.get(toolName);
     if (unsupportedReason) {
         return toolResult(false, { tool: toolName, error: unsupportedReason });
@@ -366,7 +438,7 @@ async function createThread(runtime, args) {
     const started = await runtime.adapter.requestAppServer('thread/start', {
         cwd,
         ...(readString(args, 'model') ?? runtime.model ? { model: readString(args, 'model') ?? runtime.model } : {}),
-        dynamicTools: CODEX_APP_DYNAMIC_TOOLS,
+        dynamicTools: CODEX_DETACHED_THREAD_DYNAMIC_TOOLS,
         experimentalRawEvents: false,
         persistExtendedHistory: true,
     });

package/dist/host.d.ts

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
 import { type TurnArtifactRoutingDecision, type TurnArtifactRoutingMode } from '@canonmsg/coding-agent-host';
-import { type CanonRuntimeCommandDescriptor, type CanonRuntimeDescriptor, type CanonRuntimePresentationPolicy, type ExecutionEnvironmentMode, type WorkspaceOption, type CanonWorkspaceRootMetadata, type RuntimeStreamingPayload, type TurnLifecycleState, type TurnOutputBlock, type TurnVerbosity, type TurnVerbosityConfig } from '@canonmsg/core';
+import { type CanonRuntimeCommandDescriptor, type CanonRuntimeDescriptor, type CanonRuntimePresentationPolicy, type ExecutionEnvironmentMode, type PreparedExecutionEnvironment, type WorkspaceOption, type CanonWorkspaceRootMetadata, type RuntimeStreamingPayload, type TurnLifecycleState, type TurnOutputBlock, type TurnVerbosity, type TurnVerbosityConfig } from '@canonmsg/core';
+import { type CodexSandboxMode } from './adapter.js';
 import { type CodexSkillMetadata } from './app-server-adapter.js';
+import { deriveCodexPermissionEnvelope } from './permission-mode.js';
 import { type CodexControlOption } from './model-catalog.js';
 interface HostSessionState {
     lastError?: string;
@@ -34,6 +36,19 @@ export declare function buildCodexLiveSessionConfig(input: {
     permissionMode?: string | undefined;
     model?: string | undefined;
 };
+export declare function buildCodexServiceSnapshotConfig(input: {
+    model?: string;
+    permissionMode?: string;
+    effort?: string;
+    workspaceId?: string;
+}): {
+    model: string | undefined;
+    permissionMode: string | undefined;
+    effort: string | undefined;
+    workspaceId: string | undefined;
+    executionMode: "locked";
+    executionBranch: null;
+};
 /** Conservative fallback used only when native app-server discovery is unavailable. */
 export declare const CODEX_EFFORT_OPTIONS: readonly CodexControlOption[];
 export declare const CODEX_SESSION_CONFIG_FIELDS: readonly ["permissionMode", "effort"];
@@ -55,6 +70,7 @@ export declare function buildCodexRuntimeDescriptor(input: {
     supportsCompact?: boolean;
     supportsRichCards?: boolean;
     skills?: ReadonlyArray<CodexSkillMetadata>;
+    serviceAgentMode?: boolean;
 }): CanonRuntimeDescriptor;
 export declare function buildCodexTurnResponseRouting(input: {
     requestingUserId?: string | null;
@@ -68,6 +84,45 @@ export declare function getCodexRequestingUserId(message: {
     senderId: string;
     senderType?: 'human' | 'ai_agent';
 }): string | null;
+export declare function resolveSessionExecutionMode(config: {
+    executionMode?: ExecutionEnvironmentMode;
+} | null | undefined, serviceAgentMode?: boolean): ExecutionEnvironmentMode;
+export declare function resolveCodexSessionConfig<T extends Record<string, unknown>>(config: T | null | undefined, serviceAgentMode?: boolean): T | null;
+export declare function resolveWorkspaceCwd(config: {
+    workspaceId?: string;
+    retiredWorkspaceConfig?: boolean;
+} | null, serviceAgentMode?: boolean): string;
+interface CodexEffectiveRuntimePolicy {
+    model?: string;
+    permissionMode?: string;
+    sandbox: CodexSandboxMode | null;
+    fullAuto: boolean;
+    bypassApprovalsAndSandbox: boolean;
+    fingerprint: string;
+}
+export declare function resolveCodexEffectiveRuntimePolicy(input: {
+    args: Record<string, unknown>;
+    config: {
+        model?: string;
+        permissionMode?: string;
+    } | null | undefined;
+    permissionEnvelope: ReturnType<typeof deriveCodexPermissionEnvelope>;
+    environment: Pick<PreparedExecutionEnvironment, 'baseCwd' | 'mode'>;
+    serviceAgentMode?: boolean;
+}): CodexEffectiveRuntimePolicy;
+export declare function resolveCodexPlanCommand(input: {
+    content: string;
+    requestedPlanMode: boolean;
+    useAppServer: boolean;
+    serviceAgentMode: boolean;
+}): {
+    planMode: boolean;
+    content: string;
+};
+export declare function isCodexPlanApprovalReply(metadata: unknown, serviceAgentMode?: boolean): metadata is Record<string, unknown> & {
+    type: 'plan_approval_reply';
+    decision: string;
+};
 /**
  * `--turn-verbosity` beats `CANON_TURN_VERBOSITY`; `null` means "unset, use the
  * per-conversation-type default".
@@ -137,6 +192,7 @@ export declare function planCodexStreamingWrite(input: {
  * same decision at its `text_delta` handler.
  */
 export declare function shouldStopTypingDotsOnStreamedText(turnVerbosity: TurnVerbosity): boolean;
+export declare function selectCodexNativeImagePaths(imagePaths: readonly string[], nativeVisionEnabled: boolean): string[];
 /**
  * Whether this turn may post the media it generated in the workspace.
  *

package/dist/host.js

@@ -6,10 +6,11 @@ import { dirname } from 'node:path';
 import { parseArgs } from 'node:util';
 import { getCodexImagePath, materializeMessageMedia, materializeReplyContextMedia, sendMediaFileMessage, } from '@canonmsg/agent-sdk';
 import { buildTrailBlockId, buildUndeliverableFinalNotice, captureTurnArtifactSnapshot, createTurnArtifactRouter, IDLE_TIMEOUT_MS, PLAN_BLOCK_TITLE, resolveTurnArtifactRouting, collectMissedInboundMessages, STARTUP_RECOVERY_MAX_MESSAGES, STARTUP_RECOVERY_PAGE_SIZE, } from '@canonmsg/coding-agent-host';
-import { RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildRuntimeCardOutcome, resolveQuestionAllowOther, buildCanonTurnContextV2, buildConfiguredWorkspaceOptionsWithRoots, buildFirstPartyCodingRuntimeDescriptor, buildHydratedInboundContext, diffCanonMemberIds, buildPublicWorkspaceRoots, buildPublicWorkspaceOptions, buildRuntimePresentationPolicy, buildCanonInboundFrameV1, DEFAULT_FIRST_PARTY_RUNTIME_PRESENTATION, createConversationMetadataLoader, createRuntimeStatePublisher, createTypingStatusPublisher, EXECUTION_ENVIRONMENT_MODES, ExecutionEnvironmentError, CanonClient, CanonStream, DEFAULT_PARTICIPATION_HISTORY_FETCH_LIMIT, DEFAULT_RUNTIME_CAPABILITIES, FINAL_MESSAGE_HANDOFF_MS, getActiveProfileLock, decideAutoReply, initRTDBAuth, buildLocalRuntimeId, heartbeatLocalRuntimeEntry, markLocalRuntimeStopped, normalizeTurnMetadata, parseRuntimeCardV1, parseTurnVerbosityConfig, RuntimeRequestManager, prepareConversationEnvironment, loadHostSessionConfig, releaseConversationEnvironment, resolveCanonAgent, verifyResolvedAgentEnvironment, CanonApiError, loadRuntimeSessionState, sendMessageWithRetry, sendMessageWithRetryChunked, saveRuntimeSessionState, publishHostAgentRuntime, publishHostSessionSnapshots, renderCanonHostInboundContent, renderCodingHostInboundPrompt, resolveHostWorkspaceCwd, isSilentTurnSuppressed, resolveSilentTurnDelivery, resolveTurnVerbosity, shouldTriggerAgentTurn, upsertLocalRuntimeEntry, } from '@canonmsg/core';
+import { RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildRuntimeCardOutcome, resolveQuestionAllowOther, buildCanonTurnContextV2, buildConfiguredWorkspaceOptionsWithRoots, buildFirstPartyCodingRuntimeDescriptor, buildHydratedInboundContext, diffCanonMemberIds, buildPublicWorkspaceRoots, buildPublicWorkspaceOptions, buildRuntimePresentationPolicy, buildCanonInboundFrameV1, DEFAULT_FIRST_PARTY_RUNTIME_PRESENTATION, createConversationMetadataLoader, createRuntimeStatePublisher, createTypingStatusPublisher, EXECUTION_ENVIRONMENT_MODES, ExecutionEnvironmentError, CanonClient, CanonStream, DEFAULT_PARTICIPATION_HISTORY_FETCH_LIMIT, DEFAULT_RUNTIME_CAPABILITIES, FINAL_MESSAGE_HANDOFF_MS, getActiveProfileLock, decideAutoReply, initRTDBAuth, buildLocalRuntimeId, heartbeatLocalRuntimeEntry, markLocalRuntimeStopped, normalizeTurnMetadata, parseTurnVerbosityConfig, RuntimeRequestManager, prepareConversationEnvironment, loadHostSessionConfig, releaseConversationEnvironment, resolveCanonAgent, verifyResolvedAgentEnvironment, CanonApiError, loadRuntimeSessionState, sendMessageWithRetry, sendMessageWithRetryChunked, saveRuntimeSessionState, publishHostAgentRuntime, publishHostSessionSnapshots, renderCanonHostInboundContent, renderCodingHostInboundPrompt, resolveHostWorkspaceCwd, isSilentTurnSuppressed, resolveSilentTurnDelivery, resolveTurnVerbosity, shouldTriggerAgentTurn, upsertLocalRuntimeEntry, } from '@canonmsg/core';
+import { validateCard } from '@canonmsg/rich-cards';
 import { CodexConversationAdapter, } from './adapter.js';
 import { CodexAppServerAdapter, } from './app-server-adapter.js';
-import { CODEX_APP_DYNAMIC_TOOLS, CODEX_NO_REPLY_MODEL_TOOL_NAME, answerCodexNoReply, classifyCodexAppToolRequest, deniedCodexAppToolResult, handleCodexAppToolCall, isCodexAppToolCall, readCodexNoReplyReason, } from './codex-app-tools.js';
+import { CODEX_APP_DYNAMIC_TOOLS, CODEX_NO_REPLY_MODEL_TOOL_NAME, CODEX_SERVICE_AGENT_DYNAMIC_TOOLS, answerCodexNoReply, classifyCodexAppToolRequest, deniedCodexAppToolResult, handleCodexAppToolCall, isCanonRuntimeControlToolCall, isCodexAppToolCall, isCodexServiceAgentToolCall, parseCanonRuntimeControlRequest, readCodexNoReplyReason, successfulCodexAppToolResult, } from './codex-app-tools.js';
 import { mapCanonApprovalResultToCodexDecision, mapCodexAppServerApprovalRequest, } from './app-server-approval.js';
 import { clearStoredThreadId, buildCodexThreadPolicyFingerprint, loadStoredThreadId, saveStoredThreadId, } from './session-store.js';
 import { deriveCodexPermissionEnvelope, mapCanonPermissionToCodex, } from './permission-mode.js';
@@ -42,6 +43,8 @@ COMMON FLAGS
                                       How much of a turn's middle readers see.
                                       Default (auto): verbose in direct chats,
                                       quiet in groups. Env: CANON_TURN_VERBOSITY
+  --service-agent                     Expose Canon conversation tools, not coding tools
+  --no-native-vision                  Keep attachment paths but omit native image input
   --help, -h                           Show this help
   --version, -V                        Show package version
 
@@ -75,6 +78,20 @@ export function buildCodexLiveSessionConfig(input) {
         executionBranch: input.executionBranch ?? null,
     };
 }
+export function buildCodexServiceSnapshotConfig(input) {
+    // Keep every setup key present, including keys whose host value is
+    // undefined. `publishHostSessionSnapshots` merges this over any persisted
+    // coding config, so an absent host value clears rather than resurrects a
+    // stale member-selected value.
+    return {
+        model: input.model,
+        permissionMode: input.permissionMode,
+        effort: input.effort,
+        workspaceId: input.workspaceId,
+        executionMode: 'locked',
+        executionBranch: null,
+    };
+}
 const MAX_SESSIONS = 12;
 // IDLE_TIMEOUT_MS (30 minutes) is shared with the other coding-agent hosts.
 const HEARTBEAT_MS = 30_000;
@@ -135,6 +152,7 @@ export function buildCodexSkillCommands(skills) {
     });
 }
 export function buildCodexRuntimeDescriptor(input) {
+    const serviceAgentMode = input.serviceAgentMode === true;
     const commands = [
         {
             id: 'runtime-status',
@@ -154,7 +172,7 @@ export function buildCodexRuntimeDescriptor(input) {
         RUNTIME_STOP_ACTION,
         RUNTIME_STOP_AND_DROP_ACTION,
     ];
-    if (input.supportsCompact) {
+    if (input.supportsCompact && !serviceAgentMode) {
         commands.push({
             id: 'codex-compact-context',
             label: 'Compact',
@@ -174,20 +192,22 @@ export function buildCodexRuntimeDescriptor(input) {
     }
     const descriptor = buildFirstPartyCodingRuntimeDescriptor({
         clientType: 'codex',
-        models: input.models,
-        workspaces: input.workspaces,
-        workspaceRoots: input.workspaceRoots,
-        executionModes: input.executionModes,
-        permissionModes: input.permissionModes,
-        defaultPermissionMode: input.defaultPermissionMode,
+        models: serviceAgentMode ? [] : input.models,
+        workspaces: serviceAgentMode ? [] : input.workspaces,
+        workspaceRoots: serviceAgentMode ? undefined : input.workspaceRoots,
+        executionModes: serviceAgentMode ? [] : input.executionModes,
+        permissionModes: serviceAgentMode ? [] : input.permissionModes,
+        defaultPermissionMode: serviceAgentMode ? undefined : input.defaultPermissionMode,
         permissionModeLabel: 'Execution policy',
         modelLiveBehavior: 'next_turn',
-        effortOptions: input.effortOptions ?? [...CODEX_EFFORT_OPTIONS],
-        defaultEffort: input.defaultEffort ?? 'medium',
+        effortOptions: serviceAgentMode
+            ? []
+            : input.effortOptions ?? [...CODEX_EFFORT_OPTIONS],
+        defaultEffort: serviceAgentMode ? undefined : input.defaultEffort ?? 'medium',
         effortLiveBehavior: 'next_turn',
         presentation: input.presentation,
         streamingTextMode: 'snapshot',
-        ...(input.supportsPlanMode
+        ...(input.supportsPlanMode && !serviceAgentMode
             ? {
                 turnModes: [
                     {
@@ -217,7 +237,7 @@ export function buildCodexRuntimeDescriptor(input) {
                     rich: {
                         schema: 'canon.card.v1',
                         lifecycle: 'blocking_requires_action',
-                        responder: 'agent_owner',
+                        ...(serviceAgentMode ? {} : { responder: 'agent_owner' }),
                         result: 'action_or_values',
                         maxTimeoutMs: 30 * 60_000,
                         blockKinds: ['summary', 'metricGrid', 'chart', 'table', 'list', 'callout', 'actions'],
@@ -228,6 +248,13 @@ export function buildCodexRuntimeDescriptor(input) {
             }
             : {}),
     });
+    if (serviceAgentMode) {
+        const { runtimeControls: _runtimeControls, ...serviceDescriptor } = descriptor;
+        return {
+            ...serviceDescriptor,
+            coreControls: [],
+        };
+    }
     if (input.models.length > 0) {
         return descriptor;
     }
@@ -259,15 +286,20 @@ async function loadSessionConfig(conversationId, agentId, rtdb) {
         extraStringFields: CODEX_SESSION_CONFIG_FIELDS,
     });
 }
-function resolveSessionExecutionMode(config) {
+export function resolveSessionExecutionMode(config, serviceAgentMode = false) {
+    if (serviceAgentMode)
+        return 'locked';
     if (config?.executionMode)
         return config.executionMode;
     throw new ExecutionEnvironmentError('Session config is missing an execution mode.', 'Choose Isolated worktree or Use shared project before starting this coding session.');
 }
-function resolveWorkspaceCwd(config) {
+export function resolveCodexSessionConfig(config, serviceAgentMode = false) {
+    return serviceAgentMode ? null : config ?? null;
+}
+export function resolveWorkspaceCwd(config, serviceAgentMode = false) {
     return resolveHostWorkspaceCwd({
         workspaceOptions,
-        config,
+        config: serviceAgentMode ? null : config,
         defaultCwd: workingDir,
     });
 }
@@ -286,9 +318,11 @@ function stringArg(args, key) {
 function boolArg(args, key) {
     return args[key] === true;
 }
-function resolveCodexEffectiveRuntimePolicy(input) {
+export function resolveCodexEffectiveRuntimePolicy(input) {
     const model = input.config?.model ?? stringArg(input.args, 'model');
-    const permissionMode = input.config?.permissionMode ?? input.permissionEnvelope.defaultPermissionMode;
+    const permissionMode = input.serviceAgentMode
+        ? input.permissionEnvelope.defaultPermissionMode
+        : input.config?.permissionMode ?? input.permissionEnvelope.defaultPermissionMode;
     if (permissionMode
         && !input.permissionEnvelope.availablePermissionModes.some((option) => option.value === permissionMode)) {
         throw new ExecutionEnvironmentError(`Permission mode "${permissionMode}" is not supported by this Codex host.`, 'This Canon host was started with stricter approval settings. Choose one of the advertised permission modes or restart the host with more permissive flags.');
@@ -304,6 +338,9 @@ function resolveCodexEffectiveRuntimePolicy(input) {
         baseCwd: input.environment.baseCwd,
         executionMode: input.environment.mode,
         permissionMode: permissionMode ?? null,
+        ...(input.serviceAgentMode
+            ? { serviceAgentMode: true, model: model ?? null }
+            : {}),
         sandbox,
         // `--ask-for-approval` is rejected at startup, so this was always null.
         // The key must stay: it is hashed into every persisted thread fingerprint.
@@ -393,6 +430,14 @@ function parsePlanCommand(content) {
         content: rest || 'Please inspect the request and propose a plan before making changes.',
     };
 }
+export function resolveCodexPlanCommand(input) {
+    if (!input.useAppServer || input.serviceAgentMode) {
+        return { planMode: false, content: input.content };
+    }
+    return input.requestedPlanMode
+        ? { planMode: true, content: input.content }
+        : parsePlanCommand(input.content);
+}
 function mapCodexQuestions(value) {
     if (!Array.isArray(value))
         return undefined;
@@ -446,6 +491,12 @@ function mapCodexQuestions(value) {
 function isRecord(value) {
     return Boolean(value && typeof value === 'object' && !Array.isArray(value));
 }
+export function isCodexPlanApprovalReply(metadata, serviceAgentMode = false) {
+    return !serviceAgentMode
+        && isRecord(metadata)
+        && metadata.type === 'plan_approval_reply'
+        && typeof metadata.decision === 'string';
+}
 function readString(record, key) {
     const value = record[key];
     return typeof value === 'string' && value.trim() ? value.trim() : undefined;
@@ -538,6 +589,9 @@ export function planCodexStreamingWrite(input) {
 export function shouldStopTypingDotsOnStreamedText(turnVerbosity) {
     return turnVerbosity !== 'quiet';
 }
+export function selectCodexNativeImagePaths(imagePaths, nativeVisionEnabled) {
+    return nativeVisionEnabled ? [...imagePaths] : [];
+}
 /**
  * Whether this turn may post the media it generated in the workspace.
  *
@@ -585,6 +639,8 @@ export async function main() {
             'show-runtime-detail': { type: 'string', multiple: true },
             'hide-runtime-detail': { type: 'string', multiple: true },
             'turn-verbosity': { type: 'string' },
+            'service-agent': { type: 'boolean' },
+            'no-native-vision': { type: 'boolean' },
             'full-auto': { type: 'boolean' },
             'dangerously-bypass-approvals-and-sandbox': { type: 'boolean' },
         },
@@ -600,6 +656,11 @@ export async function main() {
         env: process.env.CANON_TURN_VERBOSITY,
         onWarning: (message) => console.error(`[canon-codex] ${message}`),
     });
+    const serviceAgentMode = args['service-agent'] === true;
+    const nativeVisionEnabled = args['no-native-vision'] !== true;
+    const codexDynamicTools = serviceAgentMode
+        ? CODEX_SERVICE_AGENT_DYNAMIC_TOOLS
+        : CODEX_APP_DYNAMIC_TOOLS;
     workingDir = (typeof args.cwd === 'string' ? args.cwd : null) || process.cwd();
     const workspaceDiscovery = buildConfiguredWorkspaceOptionsWithRoots({
         primaryCwd: workingDir,
@@ -1116,6 +1177,8 @@ export async function main() {
         if (!session)
             return;
         session.closed = true;
+        session.currentTurnAbortController?.abort(new Error('Codex session closed'));
+        session.currentTurnAbortController = null;
         stopVisibleWorkSignal(session);
         if ('close' in session.adapter && typeof session.adapter.close === 'function') {
             session.adapter.close();
@@ -1139,6 +1202,7 @@ export async function main() {
         session.activeSelfContextId = null;
         session.state.lastError = undefined;
         if (session.running) {
+            session.currentTurnAbortController?.abort(new Error('Codex session reset'));
             await session.adapter.interrupt();
             session.turnState = 'interrupted';
         }
@@ -1185,9 +1249,9 @@ export async function main() {
             evictOldestIdle();
         }
         const creation = (async () => {
-            const config = await loadSessionConfig(conversationId, agentId, rtdb);
-            const sessionExecutionMode = resolveSessionExecutionMode(config);
-            const workspaceCwd = resolveWorkspaceCwd(config);
+            const config = resolveCodexSessionConfig(await loadSessionConfig(conversationId, agentId, rtdb), serviceAgentMode);
+            const sessionExecutionMode = resolveSessionExecutionMode(config, serviceAgentMode);
+            const workspaceCwd = resolveWorkspaceCwd(config, serviceAgentMode);
             const environment = prepareConversationEnvironment({
                 agentId,
                 conversationId,
@@ -1201,6 +1265,7 @@ export async function main() {
                     config,
                     permissionEnvelope: codexPermissionEnvelope,
                     environment,
+                    serviceAgentMode,
                 });
                 const modelGuard = buildCodexModelGuardMessage(policy.model, codexCliStatus);
                 if (modelGuard) {
@@ -1226,7 +1291,7 @@ export async function main() {
                         configOverrides: args.config ?? [],
                         fullAuto: policy.fullAuto,
                         bypassApprovalsAndSandbox: policy.bypassApprovalsAndSandbox,
-                        dynamicTools: CODEX_APP_DYNAMIC_TOOLS,
+                        dynamicTools: codexDynamicTools,
                     })
                     : new CodexConversationAdapter({
                         cwd: sessionCwd,
@@ -1259,6 +1324,7 @@ export async function main() {
                     currentTurnOpenedAt: null,
                     currentTurnUpdatedAt: null,
                     currentTurnCanUseCodexAppTools: false,
+                    currentTurnAbortController: null,
                     // Corrected by the first turn that runs; a session with no turn
                     // publishes nothing anyway, and quiet is never an accident.
                     turnVerbosity: 'verbose',
@@ -1333,7 +1399,10 @@ export async function main() {
         // No `turnVerbosity`: this prompt continues the same conversation, so it
         // keeps whatever the session last resolved rather than reverting to the
         // default.
-        enqueuePrompt(session, prompt, 'queue', false, result.receiptId ?? null, false, [], [], result.status !== 'approve', { requestingUserId: responseUserId });
+        enqueuePrompt(session, prompt, 'queue', false, result.receiptId ?? null, false, [], [], result.status !== 'approve', {
+            canUseCodexAppTools: serviceAgentMode || responseUserId === ownerId,
+            requestingUserId: responseUserId,
+        });
     }
     function resolveArtifactRoutingMode(participantContext) {
         return participantContext.conversationType === 'direct' && participantContext.isOwner
@@ -1349,7 +1418,7 @@ export async function main() {
     function resolveCodexTurnModes(participantContext, message) {
         return {
             artifactRoutingMode: resolveArtifactRoutingMode(participantContext),
-            canUseCodexAppTools: participantContext.isOwner,
+            canUseCodexAppTools: participantContext.isOwner || serviceAgentMode,
             turnVerbosity: resolveTurnVerbosity({
                 configured: configuredTurnVerbosity,
                 conversationType: participantContext.conversationType,
@@ -1371,6 +1440,9 @@ export async function main() {
         const params = request.params;
         const expiresAt = Date.now() + 30 * 60_000;
         if (request.method === 'item/tool/call' && isCodexAppToolCall(params)) {
+            if (serviceAgentMode && !isCodexServiceAgentToolCall(params)) {
+                return deniedCodexAppToolResult('This service agent exposes only Canon conversation tools.');
+            }
             // The admission order — no_reply above the owner gate — is pinned by
             // `classifyCodexAppToolRequest`'s tests, not by the shape of this block.
             const disposition = classifyCodexAppToolRequest({
@@ -1393,6 +1465,102 @@ export async function main() {
             if (disposition === 'denied-non-owner') {
                 return deniedCodexAppToolResult('Only the Canon owner can use codex_app tools.');
             }
+            if (isCanonRuntimeControlToolCall(params)) {
+                const command = parseCanonRuntimeControlRequest(params);
+                if (!command) {
+                    return deniedCodexAppToolResult('Invalid canon_runtime_control arguments.');
+                }
+                if (command.action === 'request_input') {
+                    if (!command.prompt) {
+                        return deniedCodexAppToolResult('request_input requires prompt.');
+                    }
+                    const responseRouting = buildCodexTurnResponseRouting({ requestingUserId, ownerId });
+                    const inputId = `codex_input_${randomUUID()}`;
+                    const question = command.placeholder
+                        ? `${command.prompt}\n\nFormat hint: ${command.placeholder}`
+                        : command.prompt;
+                    const response = await runtimeRequests.request('input', session.conversationId, {
+                        kind: 'clarify',
+                        title: 'Input requested',
+                        prompt: command.prompt,
+                        questions: [{ id: 'response', header: 'Response', question, allowOther: true }],
+                        ...(responseRouting.responseUserId
+                            ? { responseUserId: responseRouting.responseUserId }
+                            : {}),
+                        turnId: session.currentTurnId ?? undefined,
+                    }, {
+                        requestId: inputId,
+                        expiresAt,
+                        signal: session.currentTurnAbortController?.signal,
+                        onCreated: () => {
+                            session.turnState = 'waiting_input';
+                            markTurnProgress(session);
+                            stopVisibleWorkSignal(session);
+                            writeTurn(session);
+                            writeCodexStreaming(session, null, 'waiting_input');
+                        },
+                    });
+                    resumeTurnFromWaiting(session);
+                    return successfulCodexAppToolResult(response);
+                }
+                const validation = validateCard(command.card);
+                if (!validation.ok || !validation.card) {
+                    return deniedCodexAppToolResult(`Invalid canon.card.v1 card: ${validation.errors.join('; ')}`);
+                }
+                const card = validation.card;
+                const interactive = card.blocks.some((block) => block.kind === 'actions');
+                if (command.action === 'send_card') {
+                    if (interactive) {
+                        return deniedCodexAppToolResult('send_card cannot contain actions; use request_card.');
+                    }
+                    const cardId = card.cardId ?? `codex_card_${randomUUID()}`;
+                    const created = await client.createRuntimeCardRequest({
+                        conversationId: session.conversationId,
+                        card: { ...card, cardId },
+                        cardId,
+                        expiresAt,
+                        turnId: session.currentTurnId ?? undefined,
+                    });
+                    return successfulCodexAppToolResult({
+                        status: 'sent',
+                        cardId: created.cardId,
+                        messageId: created.messageId,
+                    });
+                }
+                if (!interactive) {
+                    return deniedCodexAppToolResult('request_card requires an actions block; use send_card.');
+                }
+                const cardId = card.cardId ?? `codex_card_${randomUUID()}`;
+                const responseRouting = buildCodexTurnResponseRouting({ requestingUserId, ownerId });
+                const response = await runtimeRequests.request('card', session.conversationId, {
+                    card,
+                    turnId: session.currentTurnId ?? undefined,
+                    ...(responseRouting.responseUserId
+                        ? { responseUserId: responseRouting.responseUserId }
+                        : {}),
+                }, {
+                    requestId: cardId,
+                    expiresAt,
+                    signal: session.currentTurnAbortController?.signal,
+                    onCreated: () => {
+                        session.turnState = 'waiting_input';
+                        markTurnProgress(session);
+                        upsertTurnBlock(session, {
+                            id: `card:${cardId}`,
+                            kind: 'input',
+                            status: 'pending',
+                            title: card.title,
+                            summary: card.template ?? 'runtime card',
+                        });
+                        writeTurn(session);
+                        stopVisibleWorkSignal(session);
+                        writeCodexStreaming(session, null, 'waiting_input');
+                    },
+                });
+                completeTurnBlock(session, `card:${cardId}`, `Card ${response.status}`);
+                resumeTurnFromWaiting(session);
+                return successfulCodexAppToolResult(response);
+            }
             // `disposition` already ruled on the transport (it is checked first, so a
             // wrong transport never reaches the branches above). This repeats the
             // test only to narrow the adapter type for the bridge call.
@@ -1410,9 +1578,13 @@ export async function main() {
         }
         const runtimeCardPayload = runtimeCardRequestPayload(request.method, params);
         if (runtimeCardPayload) {
-            const card = parseRuntimeCardV1(runtimeCardPayload);
-            if (!card) {
-                return { status: 'cancelled', error: 'Invalid canon.card.v1 card' };
+            const validation = validateCard(runtimeCardPayload);
+            const card = validation.card;
+            if (!validation.ok || !card) {
+                return {
+                    status: 'cancelled',
+                    error: `Invalid canon.card.v1 card: ${validation.errors.join('; ')}`,
+                };
             }
             const cardId = readString(params, 'cardId')
                 ?? readString(params, 'itemId')
@@ -1443,6 +1615,7 @@ export async function main() {
                 }, {
                     requestId: cardId,
                     expiresAt,
+                    signal: session.currentTurnAbortController?.signal,
                     onCreated: () => {
                         requestCreated = true;
                         session.turnState = 'waiting_input';
@@ -1464,8 +1637,14 @@ export async function main() {
                         status: 'submitted',
                         ...(cardResult.actionId ? { actionId: cardResult.actionId } : {}),
                         ...(cardResult.values ? { values: cardResult.values } : {}),
+                        ...(cardResult.respondedBy ? { respondedBy: cardResult.respondedBy } : {}),
                     }
-                    : { status: cardResult.status };
+                    : {
+                        status: cardResult.status,
+                        ...('respondedBy' in cardResult && cardResult.respondedBy
+                            ? { respondedBy: cardResult.respondedBy }
+                            : {}),
+                    };
                 requestResolved = true;
                 const outcome = buildRuntimeCardOutcome(cardId, response.status, { reason: response.status });
                 await sendMessageWithRetry(client, session.conversationId, outcome.text, {
@@ -1535,7 +1714,11 @@ export async function main() {
                     },
                 },
                 turnId: session.currentTurnId ?? undefined,
-            }, { requestId: inputId, expiresAt });
+            }, {
+                requestId: inputId,
+                expiresAt,
+                signal: session.currentTurnAbortController?.signal,
+            });
             resumeTurnFromWaiting(session);
             return { answers: response.status === 'submitted' ? response.answers ?? {} : {} };
         }
@@ -1554,7 +1737,11 @@ export async function main() {
                     ? { responseUserId: responseRouting.responseUserId }
                     : {}),
                 allowSessionRule: responseRouting.allowSessionRule,
-            }, { requestId: approvalId, expiresAt });
+            }, {
+                requestId: approvalId,
+                expiresAt,
+                signal: session.currentTurnAbortController?.signal,
+            });
             resumeTurnFromWaiting(session);
             if (request.method === 'item/permissions/requestApproval') {
                 return response.decision === 'allow'
@@ -1575,9 +1762,14 @@ export async function main() {
             persistInboundRecoveryCursorWhenIdle(input.conversationId, input.message.id);
             return;
         }
-        if (isRecord(input.message.metadata)
-            && input.message.metadata.type === 'plan_approval_reply'
-            && typeof input.message.metadata.decision === 'string') {
+        if (input.message.metadata?.type === 'plan_approval_reply') {
+            if (!isCodexPlanApprovalReply(input.message.metadata, serviceAgentMode)) {
+                // A service agent never advertises or enters plan mode. Consume stale
+                // replies left by an older coding descriptor instead of turning them
+                // into hidden plan/implementation prompts after an upgrade or restart.
+                persistInboundRecoveryCursorWhenIdle(input.conversationId, input.message.id);
+                return;
+            }
             const planId = readString(input.message.metadata, 'planId');
             if (planId && runtimeRequests.handleMessage(input.conversationId, {
                 senderId: input.message.senderId,
@@ -1595,7 +1787,7 @@ export async function main() {
                     ? `The plan was declined — keep planning and wait for guidance before implementing.${feedback ? `\n\nNotes:\n${feedback}` : ''}`
                     : `Please revise the plan.${feedback ? `\n\nRevision feedback:\n${feedback}` : ''}`;
             enqueuePrompt(session, prompt, 'queue', false, input.message.id, false, [], [], decision !== 'approve', {
-                canUseCodexAppTools: input.isOwner,
+                canUseCodexAppTools: input.isOwner || serviceAgentMode,
                 requestingUserId: getCodexRequestingUserId(input.message),
             });
             return;
@@ -1615,11 +1807,12 @@ export async function main() {
         const renderedContent = renderInboundContent(input.message, materialized);
         const turnMetadata = normalizeTurnMetadata(input.message.metadata);
         const requestedPlanMode = turnMetadata?.requestedTurnMode === 'plan';
-        const planCommand = useAppServer
-            ? requestedPlanMode
-                ? { planMode: true, content: renderedContent }
-                : parsePlanCommand(renderedContent)
-            : { planMode: false, content: renderedContent };
+        const planCommand = resolveCodexPlanCommand({
+            content: renderedContent,
+            requestedPlanMode,
+            useAppServer,
+            serviceAgentMode,
+        });
         const content = planCommand.content;
         const hydrated = await loadHydratedInboundContext({
             conversationId: input.conversationId,
@@ -1642,9 +1835,10 @@ export async function main() {
         });
         const replyContext = replyMedia.replyContext;
         const promptMaterialized = [...replyMedia.materialized, ...materialized];
-        const imagePaths = promptMaterialized
+        const discoveredImagePaths = promptMaterialized
             .map((attachment) => getCodexImagePath(attachment))
             .filter((path) => path !== null);
+        const imagePaths = selectCodexNativeImagePaths(discoveredImagePaths, nativeVisionEnabled);
         const mediaAddDirs = uniqueStrings(promptMaterialized.map((attachment) => dirname(attachment.path)));
         const participantContext = hydrated.participantContext;
         const autoReply = input.turnDispatch?.kind === 'run_turn'
@@ -1698,6 +1892,7 @@ export async function main() {
         if (session.running && deliveryIntent === 'interrupt') {
             enqueuePrompt(session, prompt, deliveryIntent, true, input.message.id, shouldMarkAccepted, imagePaths, mediaAddDirs, planCommand.planMode, resolveCodexTurnModes(participantContext, input.message));
             console.error(`[canon-codex] [${input.conversationId.slice(0, 8)}] Interrupting current turn for explicit human send-now`);
+            session.currentTurnAbortController?.abort(new Error('Codex turn interrupted by a newer message'));
             await session.adapter.interrupt().catch(() => { });
             clearStreaming(input.conversationId);
             typingSignals.clear(input.conversationId).catch(() => { });
@@ -1734,6 +1929,7 @@ export async function main() {
         session.currentTurnOpenedAt = Date.now();
         session.currentTurnUpdatedAt = session.currentTurnOpenedAt;
         session.currentTurnCanUseCodexAppTools = nextTurn.canUseCodexAppTools === true;
+        session.currentTurnAbortController = new AbortController();
         // A continuation prompt (a plan-review result) carries none, and keeps the
         // conversation's last answer rather than silently reverting to verbose.
         session.turnVerbosity = nextTurn.turnVerbosity ?? session.turnVerbosity;
@@ -2135,6 +2331,8 @@ export async function main() {
             console.error(`[canon-codex] [${session.conversationId.slice(0, 8)}] Turn failed:`, error);
         }
         finally {
+            session.currentTurnAbortController?.abort(new Error('Codex turn ended'));
+            session.currentTurnAbortController = null;
             persistInboundRecoveryCursor(session.conversationId, nextTurn.sourceMessageId);
             if (session.pendingDroppedRecoveryCursor) {
                 persistInboundRecoveryCursor(session.conversationId, session.pendingDroppedRecoveryCursor);
@@ -2184,10 +2382,10 @@ export async function main() {
         }
     }
     let streamConnected = false;
-    const hostAvailableExecutionModes = [
-        ...EXECUTION_ENVIRONMENT_MODES,
-    ];
-    const codexPermissionEnvelope = deriveCodexPermissionEnvelope(args);
+    const hostAvailableExecutionModes = serviceAgentMode
+        ? ['locked']
+        : [...EXECUTION_ENVIRONMENT_MODES];
+    const codexPermissionEnvelope = deriveCodexPermissionEnvelope(serviceAgentMode ? { sandbox: 'read-only' } : args);
     const configuredCodexEffort = readCodexConfiguredEffort(args.config ?? []);
     let codexModels = [];
     let codexModelOptions = buildCodexModelOptions(codexModels, args.model);
@@ -2206,14 +2404,18 @@ export async function main() {
     });
     let codexSkills = [];
     const buildCurrentRuntimeDescriptor = () => ({
-        defaultWorkspaceId: workspaceOptions[0]?.id,
+        ...(serviceAgentMode
+            ? {}
+            : {
+                defaultWorkspaceId: workspaceOptions[0]?.id,
+                availableWorkspaces: buildPublicWorkspaceOptions(workspaceOptions),
+                availableExecutionModes: hostAvailableExecutionModes,
+                availablePermissionModes: [...codexPermissionEnvelope.availablePermissionModes],
+                ...(codexPermissionEnvelope.defaultPermissionMode
+                    ? { defaultPermissionMode: codexPermissionEnvelope.defaultPermissionMode }
+                    : {}),
+            }),
         ...(codexDefaultModel ? { defaultModel: codexDefaultModel } : {}),
-        availableWorkspaces: buildPublicWorkspaceOptions(workspaceOptions),
-        availableExecutionModes: hostAvailableExecutionModes,
-        availablePermissionModes: [...codexPermissionEnvelope.availablePermissionModes],
-        ...(codexPermissionEnvelope.defaultPermissionMode
-            ? { defaultPermissionMode: codexPermissionEnvelope.defaultPermissionMode }
-            : {}),
         runtimeDescriptor: buildCodexRuntimeDescriptor({
             models: codexModelOptions,
             effortOptions: codexEffortOptions,
@@ -2228,6 +2430,7 @@ export async function main() {
             supportsCompact: useAppServer,
             supportsRichCards: useAppServer,
             skills: codexSkills,
+            serviceAgentMode,
         }),
     });
     let runtimeDescriptor = buildCurrentRuntimeDescriptor();
@@ -2273,6 +2476,11 @@ export async function main() {
         const session = sessions.get(conversationId);
         if (!session || session.closed)
             return;
+        if (serviceAgentMode) {
+            console.error(`[canon-codex] [${conversationId.slice(0, 8)}] Ignoring user session controls for service-agent runtime`);
+            writeState(session);
+            return;
+        }
         let modelChanged = false;
         if (control.model && control.model !== session.state.model) {
             if (codexModelOptions.length > 0 && !codexModelOptions.some((option) => option.value === control.model)) {
@@ -2345,6 +2553,7 @@ export async function main() {
             rememberDroppedRecoveryCursor(session, droppedPrompts);
         }
         if (session.running) {
+            session.currentTurnAbortController?.abort(new Error(`Codex turn interrupted by ${type}`));
             await session.adapter.interrupt();
         }
         session.turnState = 'interrupted';
@@ -2428,10 +2637,27 @@ export async function main() {
                 workspaceOptions,
                 defaultCwd: workingDir,
                 extraSessionConfigFields: CODEX_SESSION_CONFIG_FIELDS,
-                liveSessionConfigByConversation: new Map(Array.from(sessions.values()).map((session) => {
+                liveSessionConfigByConversation: new Map(Array.from(serviceAgentMode ? knownConversationIds : sessions.keys()).map((conversationId) => {
+                    const session = sessions.get(conversationId);
+                    if (serviceAgentMode) {
+                        return [
+                            conversationId,
+                            buildCodexServiceSnapshotConfig({
+                                model: codexDefaultModel ?? session?.state.model ?? undefined,
+                                permissionMode: codexPermissionEnvelope.defaultPermissionMode,
+                                effort: codexDefaultEffort ?? session?.state.effort ?? undefined,
+                                workspaceId: resolveWorkspaceIdForBaseCwd(workingDir) ?? undefined,
+                            }),
+                        ];
+                    }
+                    if (!session) {
+                        // Non-service snapshots are published only for live sessions,
+                        // but keep this branch total if that invariant changes.
+                        return [conversationId, {}];
+                    }
                     const workspaceId = resolveWorkspaceIdForBaseCwd(session.environment.baseCwd);
                     return [
-                        session.conversationId,
+                        conversationId,
                         buildCodexLiveSessionConfig({
                             model: session.state.model,
                             permissionMode: session.state.permissionMode,
@@ -2600,7 +2826,7 @@ export async function main() {
                 console.error(`[canon-codex] [${conversationId.slice(0, 8)}] Recovery cursor was not found within ${STARTUP_RECOVERY_MAX_MESSAGES} messages; replaying the bounded recent window`);
             }
             for (const message of recovered.messages) {
-                const isPlanReply = message.metadata?.type === 'plan_approval_reply';
+                const isPlanReply = isCodexPlanApprovalReply(message.metadata, serviceAgentMode);
                 if (!isPlanReply && !shouldTriggerAgentTurn({
                     senderType: message.senderType,
                     metadata: message.metadata,
@@ -2666,6 +2892,9 @@ export async function main() {
         controlPoller.stop();
         clearInterval(heartbeat);
         clearInterval(idleCheck);
+        for (const session of sessions.values()) {
+            session.currentTurnAbortController?.abort(new Error('Codex host shutting down'));
+        }
         runtimeRequests.dispose();
         stream.stop();
         await runtimeState.clearAgentRuntime().catch(() => { });

package/dist/session-store.d.ts

@@ -3,6 +3,8 @@ export declare function buildCodexThreadPolicyFingerprint(input: {
     baseCwd: string;
     executionMode?: ExecutionEnvironmentMode;
     permissionMode?: string | null;
+    model?: string | null;
+    serviceAgentMode?: boolean;
     sandbox?: string | null;
     approvalPolicy?: string | null;
     fullAuto?: boolean;

package/dist/session-store.js

@@ -6,6 +6,14 @@ export function buildCodexThreadPolicyFingerprint(input) {
         baseCwd: input.baseCwd,
         executionMode: input.executionMode ?? null,
         permissionMode: input.permissionMode ?? null,
+        // Service agents make the model a host-owned runtime choice. Include it,
+        // plus an explicit service-mode marker, so the first service-agent
+        // release drops coding threads that may retain a member-selected model
+        // and later host model changes start a clean thread. Ordinary Codex host
+        // fingerprints intentionally remain byte-for-byte compatible.
+        ...(input.serviceAgentMode
+            ? { serviceAgentMode: true, model: input.model ?? null }
+            : {}),
         sandbox: input.sandbox ?? null,
         approvalPolicy: input.approvalPolicy ?? null,
         fullAuto: input.fullAuto === true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonmsg/codex-plugin",
-  "version": "0.25.1",
+  "version": "0.26.2",
   "description": "Canon host integration for Codex CLI",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "scripts"
   ],
   "scripts": {
-    "prepare:workspace-deps": "node ../../scripts/run-workspace-prep.mjs ../core ../agent-sdk ../coding-agent-host",
+    "prepare:workspace-deps": "node ../../scripts/run-workspace-prep.mjs ../core ../agent-sdk ../coding-agent-host ../rich-cards",
     "build": "npm run prepare:workspace-deps && node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc",
     "dev": "npm run prepare:workspace-deps && tsc --watch",
     "smoke": "node scripts/smoke-test.mjs",
@@ -31,7 +31,8 @@
   "dependencies": {
     "@canonmsg/agent-sdk": "^8.3.0",
     "@canonmsg/coding-agent-host": "^0.5.0",
-    "@canonmsg/core": "^10.2.0"
+    "@canonmsg/core": "^10.3.1",
+    "@canonmsg/rich-cards": "^0.10.0"
   },
   "engines": {
     "node": ">=18.0.0"